SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 98

changes.mady.by.user Pamela Curtis

Saved on

compared with

New Version 99

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Any code that uses this method is susceptible to a resource exhaustion attack because the user can enter a string of any length.

Compliant Solution (

...

Java 1.7, Limited File Size)

This compliant solution imposes limits, both a limit on the length of each line and on the total number of items to add to the vector.size of the file being read. This is accomplished with the Files.size() method, which is new to Java 1.7. If the file is within the limit, we can assume the standard readLine() method will not exhaust memory, nor will memory be exhausted by the while loop.

Code Block
bgColor#ccccff

class ShowHeapError {
Code Block
bgColor#ccccff

class ShowHeapError {
  // ... other methods

  static public final String readLimitedLine(Reader reader, int limitint fileSizeLimit = 1000000;

  public ShowHeapError(String filename) throws IOException {
    StringBuilder sb = new StringBuilder();if (Files.size(Paths.get(filename)) > fileSizeLimit) {
    for (int ithrow = 0; i < limit; i++) {
  new IOException("File too large");
    }
    intthis.input c= =new reader.readFileReader(filename);
    this.reader = ifnew (c == -1) {BufferedReader(input);
  }

  // ...other methods
}

Compliant Solution (Limited Length Input)

This compliant solution imposes limits, both on the length of each line and on the total number of items to add to the vector. (It does not depend on any Java 1.7 features.)

Code Block
bgColor#ccccff

class ShowHeapError {
  // ... other methods

  static public String readLimitedLine(Reader reader, int limit) throws IOException {
    StringBuilder sb = new StringBuilder   return null;
      }
      if (((char) c == '\n') || ((char) c == '\r')) {
        break;
      }
      sb.append((char) c);
    }
    return sb.toString();
  }

  static public final for (int lineLengthLimiti = 10240;
 i static< public final int lineCountLimit = 1000000;

  public void addNames() throws IOException {
    try {limit; i++) {
      int c = reader.read();
      if (c == -1) {
        return null;
      String newName;}
      forif (int i((char) c = 0; i < lineCountLimit; i++= '\n') || ((char) c == '\r')) {
        newName = readLimitedLine(reader, lineLengthLimit)break;
      }
  if (newName == null || newNamesb.equalsIgnoreCase("quit")) {
append((char) c);
    }
    return sb.toString();
  break;}

  static public final int lineLengthLimit = }
1024;
  static public final int lineCountLimit  names.addElement(newName);= 1000000;

  public void addNames() throws   System.out.println("adding " + newName);
IOException {
    try {
      String newName;
       }
    } finally {
for (int i = 0; i < lineCountLimit; i++) {
        newName = input.close(readLimitedLine(reader, lineLengthLimit);
     }
  }

}

The readLimitedLine() method defined above takes a numeric limit, indicating the total number of characters that may exist on one line. If a line contains more characters, the line is truncated, and they are returned on the next invocation. This prevents an attacker from exhausting memory by supplying input with no line breaks.

Compliant Solution (Java 1.7, Limited File Size)

This compliant solution imposes a limit on the size of the file being read. This is accomplished with the Files.size() method, which is new to Java 1.7. If the file is within the limit, we can assume the standard readLine() method will not exhaust memory, nor will memory be exhausted by the while loop.

Code Block
bgColor#ccccff

class ShowHeapError {
  static public final int fileSizeLimit = 1000000;

  public ShowHeapError(String filename) throws IOException {
    if (Files.size(Paths.get(filename)) > fileSizeLimit) {
      throw new IOException("File too large");
   if (newName == null || newName.equalsIgnoreCase("quit")) {
          break;
        }

        names.addElement(newName);
        System.out.println("adding " + newName);
      }
     this.input = new FileReader(filename} finally {
      input.close();
    }
 this.reader = new BufferedReader(input);
  }

  // ...other methods
}
 }

}

The readLimitedLine() method defined above takes a numeric limit, indicating the total number of characters that may exist on one line. If a line contains more characters, the line is truncated, and they are returned on the next invocation. This prevents an attacker from exhausting memory by supplying input with no line breaks.

Noncompliant Code Example

...

CERT C Secure Coding Standard

MEM11-C. Do not assume infinite heap space

CERT C++ Secure Coding Standard

MEM12-CPP. Do not assume infinite heap space

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="697cc642d1b4a9c8-9827eb13-4e274812-a5708600-c26287090c410915228d5d7a"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

"Resource Exhaustion [XZP]"

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-400, "Uncontrolled Resource Consumption ('Resource Exhaustion')"

 

CWE-770, "Allocation of Resources Without Limits or Throttling"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="d4a46d6e014dbd7c-c29c480b-4a1941e1-9a5ca51d-b802d44692a1a99c1f6f7a11"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

Class ObjectInputStream and ObjectOutputStream

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="8a74c530f2ca9998-6ad8346c-44b64c3f-bcbaab5a-0c0c6304b5c5c232a076feeb"><ac:plain-text-body><![CDATA[

[[Java 2006

AA. Bibliography#Java 06]]

[java - the Java application launcher

http://java.sun.com/javase/6/docs/technotes/tools/windows/java.html ], "Syntax for increasing the heap size"

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="af4755f30035f5c6-c53b84de-45fa41d9-b2b695dd-13d20172bd12a4cba758dfde"><ac:plain-text-body><![CDATA[

[[SDN 2008

AA. Bibliography#SDN 08]]

[Serialization FAQ

http://java.sun.com/javase/technologies/core/basic/serializationFAQ.jsp]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="34cf5628af0ca8c7-6f0595e7-476044ec-bcc8bb6f-330b46967e14c895b1df1170"><ac:plain-text-body><![CDATA[

[[Sun 2003

AA. Bibliography#Sun 03]]

Chapter 5: Tuning the Java Runtime System, [Tuning the Java Heap

http://docs.sun.com/source/817-2180-10/pt_chap5.html#wp57027]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5d6032f365cd1308-6f73e0c4-49ea4f33-b5eb97df-0f7e68f90110e531574d8b46"><ac:plain-text-body><![CDATA[

[[Sun 2006

AA. Bibliography#Sun 06]]

[Garbage Collection Ergonomics

http://java.sun.com/javase/6/docs/technotes/guides/vm/gc-ergonomics.html ], "Default values for the Initial and Maximum heap size"

]]></ac:plain-text-body></ac:structured-macro>

...